2016 / Detect, Disrupt, Deter 391 ARTICLE Detect, Disrupt, Deter: A Whole-of-Government Approach to National Security Cyber Threats ________________________ John P. Carlin* * Assistant Attorney General for National Security, United States Department of Justice. I would like to thank David Forscey, Chloe Goodwin, Megan Henry, Sarah Howard, Allison Kempf, Alan Rozenshtein, Paul Schied, Yishai Schwartz, and Joshua Silverstein for their help in preparing this Article. I would also like to thank Josh Goldfoot, Chris Hardee, Adam Hickey, Alex Iftimie, James Melendres, Anita Singh, Brad Wiegmann, and several other individuals both inside and outside the government for their comments and assistance. This material has been reviewed by the Department of Justice to prevent the disclosure of classified information. Copyright © 2016 by the Presidents and Fellows of Harvard College and John P. Carlin 392 Harvard National Security Journal / Vol. 7 Table of Contents Introduction ....................................................................................................... 393 I. The Cyber Threat and the Need for Deterrence ......................................... 398 A. Means of Intrusion and Attack .................................................................. 398 B. Threat Actors ............................................................................................ 401 C. Motivations ............................................................................................... 404 II. Attribution and the Role of Investigations ................................................. 409 A. The Post-9/11 National Security Evolution of the Department of Justice ................................................................................................... 410 B. Tools for Attribution ................................................................................. 414 III. An All-Tools Approach to National Security Cyber Threats ................. 418 A. DOJ-Led Activity ...................................................................................... 418 1. Prosecution .......................................................................................... 418 2. Other Civil and Criminal Actions ........................................................ 424 3. New Proposals ..................................................................................... 427 B. DOJ’s Role in a Whole-of-Government Approach ................................... 428 C. Public-Private Collaboration ................................................................... 430 Conclusion .......................................................................................................... 435 2016 / Detect, Disrupt, Deter 393 Introduction The United States faces an inflection point when it comes to the Internet’s effect on daily life. What has enriched our economy and quality of life for the past several decades may start to hurt us more than help us, unless we confront its cybersecurity challenges.1 Waves of network intrusions—increasing in number, sophistication, and severity—have hit American companies and the U.S. government. In 2012, former CIA Director and Defense Secretary Leon Panetta described the nation’s cybersecurity weaknesses as presenting a “pre-9/11 moment.”2 And in July 2014, the 9/11 Commission itself warned: “We are at September 10th levels in terms of cyber preparedness.”3 Following that ominous prediction, in a span of less than two years, the United States was besieged by intrusions originating from around the globe. There was no single target, and no common perpetrator. Our adversaries stated or demonstrated that they hacked on behalf of China, North Korea, Syria, Iran, and many others. They stole sensitive information from government databases, damaged and destroyed private companies’ computer systems, and—in a new twist—even targeted individuals’ personally identifiable information to benefit terrorist organizations. The list of victims is broad and varied—the private sector, the government, and individual citizens. The past two years have publicly demonstrated the extent of the threat. Former Federal Bureau of Investigation (FBI) Director Robert Mueller once offered the following analogy to describe our growing cyber vulnerabilities: In the days of the Roman Empire, roads radiated out from the capital city, spanning more than 52,000 miles. The Romans built these roads to access the vast areas they had conquered. But, in the 1 For the purposes of this Article, “cybersecurity” means the protection of “computers, networks, programs and data from unintended or unauthorized access, change or destruction.” “Cyberspace” refers to the “interdependent network of information technology infrastructures[] that includes the Internet, telecommunications networks, computer systems and embedded processors and controllers.” What is Cyber Security?, UNIV. OF MD. UNIV. COLL., http://www.umuc.edu/ cybersecurity/about/cybersecurity-basics.cfm. Importantly, cybersecurity extends to the protection of devices that are connected to the Internet—whether large-scale critical infrastructure or consumer devices (e.g., the emerging “Internet of Things”). More generally, the word or prefix “cyber” broadly refers to the domain of activity that arises from the close integration of computers, and in particular the Internet, into our society. The term has its detractors, who prefer more specific terms like “online” or “network.” Nevertheless, the term is used here to capture, in one word, otherwise disperse subjects that are the greatest concern in governance. 2 Leon E. Panetta, U.S. Sec’y of Def., Remarks by Secretary Panetta on Cybersecurity to the Business Executives for National Security, New York City (Oct. 11, 2012), http://archive.defense.gov/transcripts/transcript.aspx?transcriptid=5136. 3 BIPARTISAN POLICY CTR., REFLECTIONS ON THE TENTH ANNIVERSARY OF THE 9/11 COMMISSION REPORT (July 2014), http://bipartisanpolicy.org/wp-content/uploads/sites/default/files/files/%20 BPC%209-11%20Commission.pdf. 394 Harvard National Security Journal / Vol. 7 end, these same roads led to Rome’s downfall, for they allowed the invaders to march right up to the city gates.4 Like the Roman roads, the Internet connects us to the world. Empowered by advances in technology like cheap storage, increased bandwidth, miniaturized processors, and cloud architecture, we’ve extended Internet connectivity throughout our lives. But this expansion carries a risk not fully accounted for. Increased connectivity makes our critical infrastructure—water, electricity, communications, banking—and our most private information more vulnerable. We invested an enormous amount over the past few decades to digitize our lives. But we made these investments while systematically underestimating risks to our digital security. If we don’t secure our Internet connectivity, what has been an important driver of prosperity and strength for the past twenty years could have disastrous effects in the next twenty. To meet this challenge, the U.S. government has changed its approach to disrupting national security cyber threats. One element of its new strategy involves implementing and institutionalizing a “whole-of-government” approach. No one agency can beat the threat. Instead, success requires drawing upon each agency’s unique expertise, resources, and legal authorities, and using whichever tool or combination of tools will be most effective in disrupting a particular threat. At times, that may mean economic sanctions from the Treasury Department, proceedings initiated by the Office of the U.S. Trade Representative, and cyber defense operations from the Defense Department. At other times, it might mean information sharing coordinated by the Department of Homeland Security, diplomatic pressure from the State Department, intelligence operations from the U.S. Intelligence Community (IC),5 and prosecution and other legal action from the Justice Department. And in many instances, it will mean a coordinated application of several capabilities from the U.S. government’s menu of options. The United States’ approach to combating Chinese theft of sensitive U.S.- company business information and trade secrets—activity that former National Security Agency Director Keith Alexander described as the “greatest transfer of 4 Robert S. Mueller, Dir., Fed. Bureau of Investigation, Speech at Penn State Forum Speaker Series State College, Pennsylvania, The FBI: Stopping Real Enemies at the Virtual Gates (Nov 6, 2007), https://www.fbi.gov/news/speeches/the-fbi-stopping-real-enemies-at-the-virtual-gates. 5 The IC is “a coalition of 17 agencies and organizations . within the Executive Branch that work both independently and collaboratively to gather and analyze the intelligence necessary to conduct foreign relations and national security activities.” OFFICE OF THE DIR. OF NAT’L INTELLIGENCE, http://www.dni.gov/index.php. It consists of: Air Force Intelligence, Army Intelligence, Central Intelligence Agency, Coast Guard Intelligence, Defense Intelligence Agency, Department of Energy, Department of Homeland Security, Department of State, Department of the Treasury, Drug Enforcement Administration, Federal Bureau of Investigation, Marine Corps Intelligence, National Geospatial-Intelligence Agency, National Reconnaissance Office, National Security Agency, Navy Intelligence, and the Office of the Director of National Intelligence. Id. 2016 / Detect, Disrupt, Deter 395 wealth in history”6—illustrates the power of this coordinated